feat(ci): publish bca CLI to PyPI as pip wheel

[dekobon]

Summary

Makes the bca CLI pip-installable: pip install big-code-analysis-cli
drops the compiled bca binary onto PATH (no Rust toolchain), the way
pip install ruff installs the ruff command. Closes #408.

The PyPI distribution name is big-code-analysis-cli while the
installed command stays bca — distinct from the importable library
bindings published as big-code-analysis. The naming split is stated
explicitly in every doc a user or maintainer touches.

What's here

• big-code-analysis-cli/pyproject.toml — maturin -b bin config:
  bindings = "bin", dynamic version from the workspace Cargo.toml
  (lockstep), license-files for LICENSE + THIRD-PARTY-LICENSES-bca.md
  → .dist-info/licenses/, globbed man-page include. No
  [tool.maturin] features needed — the crate already pins all-languages
  (feat(lib): per-language Cargo features for grammar selection #252), so the bin build carries every grammar.
• .github/workflows/python-cli-wheels.yml — standalone, modeled on
  python-wheels.yml: numeric-tag trigger, opt-in python-cli-wheels PR
  label, build matrix (Linux manylinux_2_28 x86_64/aarch64, macOS
  x86_64/arm64, Windows x86_64), per-leg cargo-about TPL staging, arch-
  specific wheel verification, clean-env smoke (install + bca --version
  tag-parity + list-metrics + cross-language parse), aggregate gate, and
  PyPI Trusted Publishing in a distinct pypi-cli environment.
• .gitignore — ignores the workflow-staged artefacts.
• Docs — CLI README, book commands/README.md, CHANGELOG, and
  RELEASING.md (one-time TP setup, per-release flow, pre-tag checklist).

Local validation (maturin 1.13.3)

Built the -b bin wheel and confirmed on Linux x86_64:

• bca installs to <env>/bin/bca (.data/scripts/bca); bca --version
  → 1.1.0 (lockstep with workspace).
• Python, Rust, and TypeScript all parse (cyclomatic.sum = 3.0
  each) → all-languages grammar set present.
• LICENSE + THIRD-PARTY-LICENSES-bca.md in .dist-info/licenses/;
  License-File: metadata recorded; bca-web.1 correctly excluded.
• maturin sdist succeeds on a clean tree (globs/license-files skip
  absent staged files — no build breakage).

make pre-commit is green (cargo trio, udeps, man-page drift gate,
self-scan, py-test, markdown/TOML/actionlint). The change set is
CI/packaging/docs only — no Rust source touched.

Release-gated follow-ups (maintainer action, tracked in #408)

These cannot be validated until release time:

• One-time PyPI Trusted Publisher registration for
  big-code-analysis-cli (workflow python-cli-wheels.yml, env
  pypi-cli) + create the pypi-cli GitHub environment.
• Create the python-cli-wheels PR label (so the matrix runs on PRs).
• First v* tag validates the cross-platform matrix + OIDC publish
  end-to-end (macOS x86_64 is cross-built on the arm64 runner — the only
  leg not exercisable locally).

Notes for reviewers

This PR has been through /review, /audit-tests, and a high-recall
/code-review pass. The review findings (SIGPIPE | head, loose macOS
arch verify, unpinned toolchain, prerelease-guard/doc mismatch, missing
version-parity assertion) are fixed in the fix(ci): commit.